Themes Vulnerabilities

Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset

Description

The theme does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.

Proof of Concept

Affects Themes

lenxel-wp
No known fix

References

CVE
CVE-2026-12586

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
8.1 (high)

Miscellaneous

Original Researcher
moonge
Submitter
moonge
Verified
Yes
WPVDB ID
84555dc3-b35e-478f-b681-ea0a0fe481d9

Timeline

Publicly Published
2026-07-21 (about 12 days ago)
Added
2026-07-21 (about 11 days ago)
Last Updated
2026-07-31 (about 1 day ago)

Other

Published
Title
Published
2024-10-25
Title
MaanStore API <= 1.0.1 - Authentication Bypass
Published
2025-12-26
Title
Mobile builder <= 1.4.2 - Authentication Bypass
Published
2024-03-22
Title
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.23 - Sensitive Information Exposure
Published
2024-11-08
Title
CE21 Suite < 2.2.1 - Authentication Bypass
Published
2026-06-05
Title
Hippoo Mobile App for WooCommerce < 1.9.5 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API